Raar virus

[Verwijderd]

Ik heb een virus maar kan hem niet vinden ( avg vindt hem telkens in restore pages, maar kan daar niet weghalen)

Heeft dit er iets mee te maken? ( dit zijn bho´s)

EDIT: het virus heet waarschijnlijk: trojan horse starpage 11 f

Spybot-S&D Browser helper object report, 9-11-2004 19:38:25 HB

{262277EC-5BB5-4849-8BF2-1824330C9CAC}
Name: 1096987973

{44FD0AF8-9D30-4E96-8ECE-306446B5E0D3}
Class file: iEBINST2.dll
Attributes: archive
Date: 29-7-2004 20:51:20
MD5: C33F0E09DCD65BC7F8C9E1BBDB4873E5
Path: C:\WINDOWS\DOWNLO~1\
Short name:
Size: 77824 bytes
Version: 255.255.255.255
Class name: No description

{60261C06-81B0-4DE0-9313-E5BA203A64E9}
Class file: pdfmgr.dll
Attributes: archive
Date: 21-9-2004 20:26:36
MD5: A4B28C6DD84F85800792DE012D2F1CD8
Path: C:\WINDOWS\DOWNLO~1\
Short name:
Size: 86016 bytes
Version: 255.255.255.255
Class name: No description

{AA58ED58-01DD-4d91-8333-CF10577473F7}
Class file: googletoolbar1.dll
Attributes: readonly archive
Date: 20-10-2004 09:24:02
MD5: 524B7615AE851B402EDFC41664D20007
Path: c:\program files\google\
Short name: GOOGLE~1.DLL
Size: 720896 bytes
Version: 0.2.0.0
Class name: Google Toolbar Helper

{C97EAD04-D1D3-4580-BDAC-EB13B6CB176E}
Class file: font.dll
Attributes: archive
Date: 26-5-2004 20:29:38
MD5: 941E5A4B952B9FFA38BE8C8DD534B3CC
Path: C:\WINDOWS\fonts\
Short name:
Size: 139264 bytes
Version: 0.1.0.0
Class name: CFilter Object
Name: IEPlus Filter

[ Voor 3% gewijzigd door Verwijderd op 09-11-2004 19:53 ]

[Verwijderd]

Heb ook nog ff deze:

Logfile of HijackThis v1.98.2
Scan saved at 19:56:57, on 9-11-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\System32\gearsec.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG6\avgcc32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\windows\system32\rundll.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Azureus\Azureus.exe
C:\Program Files\Java\j2re1.4.2\bin\javaw.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\Programs\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about: blank
O2 - BHO: 1096987973 - {262277EC-5BB5-4849-8BF2-1824330C9CAC} - (no file)
O2 - BHO: No description - {44FD0AF8-9D30-4E96-8ECE-306446B5E0D3} - C:\WINDOWS\DOWNLO~1\iEBINST2.dll__SpybotSDDisabled (file missing)
O2 - BHO: No description - {60261C06-81B0-4DE0-9313-E5BA203A64E9} - C:\WINDOWS\DOWNLO~1\pdfmgr.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: IEPlus Filter - {C97EAD04-D1D3-4580-BDAC-EB13B6CB176E} - C:\WINDOWS\fonts\font.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AVG_CC] C:\Program Files\Grisoft\AVG6\avgcc32.exe /startup
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RunDll] C:\windows\system32\rundll.exe
O4 - HKLM\..\Run: [winlogon] C:\windows\winlogon.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
O4 - Startup: Xfire.lnk.disabled
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Gelijkwaardige pagina's - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Koppelingspagina's - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Opgeslagen momentopname van de pagina - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Broken Internet access because of LSP provider 'xfire_lsp_9717.dll' missing
O16 - DPF: {0AE533FE-B805-4FD6-8AE1-A619FBEE7A23} (IntraLaunch.MainControl) - file://c:\IntraLaunch\sample\IntraLaunch.CAB
O16 - DPF: {44FD0AF8-9D30-4E96-8ECE-306446B5E0D3} (No description) - http://naupoint.com/toolbar/installer/iEBINST2.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.c...21819/netzip/RdxIE601.cab
O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - http://10.0.0.139/tsweb/msrdp.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/do...s/suite/yautocomplete.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CCC728DD-4D1D-4086-AA5F-043CCC1D5F4C}: NameServer = 10.0.0.138

[Verwijderd]

Begin eens met Beveiliging en Virussen - Nieuw topic starten door te nemen/werken, hier valt zo veel te weinig uit op te maken.

Verder raad ik je aan eens de WOS FAQ/GoT search te gebruiken mbt. je system restore probleem.

Open een nieuw topic waaraan duidelijk te zien is dat je aandacht hebt besteed aan bovenstaande items, mocht dat nog nodig zijn.

Dicht.

[Verwijderd]

En gelieve in het vervolg je (start)post te editen ipv. zelf meerdere malen te posten, kicken mag pas na 24 uur.